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Amendment "D" 



AMENDMENTS TO THE CLAIMS 



This listing of claims replaces all prior versions and listings of claims in the application: 



network, the network traffic having been captured at a network monitoring computer during a 
period of time, the method comprising: 

at a user computer remote from the network monitoring computer, receiving data 
points corresponding to the captured network traffic, the data points comprising: 

for the captured network traffic, start time, end time, total frames and total 
bytes; and 

information about sections of the captured network traffic, the information 
including start time, end time, number of frames in the section and number of 
bytes in the section; [[and]] 

storing a histogram, including the data points, at the user compute r, the histogram 
fiirther including a listing and description of downloaded captured data files stored on the 
user computer: and 

using the listing and description of downloaded captured data files to code 
portions of a capture histogram and a zoom histogram with a first indicator representing 

sections stored at the user computer . 

2. (Currently Amended) The method of claim 1, fiirther comprising at the 
user computer, presenting a user with a graphical user interface representation of the network 
traffic by graphing byte density over time in [[a]]tiie capture histogram by using the histogram. 

3. (Currently Amended) The method of claim 2, wherein presenting a user 
with a graphical user interface representation of the network traffic comprises: 

including a zoom window, the zoom window usefiil for highlighting a segment of 
the capture histogram; and 

representing the segment of the capture histogram in [[a]]tlie zoom histogram. 

4. (Original) The method of claim 3, fiirther comprising: 



1. 



(Currently Amended) 



A method of analyzing network traffic on a 
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including a data selection window useful for highlighting a segment of the zoom 
histogram; 

storing a first downloaded captured data file that includes sections corresponding 
to the segment of the zoom histogram highlighted by the data selection window; and 

displaying data frames corresponding to the highlighted segment of the zoom 
window. 

5. (Original) The method of claim 4, further comprising storing a second 
downloaded captured data file that includes sections corresponding to a segment of the zoom 
histogram previously highlighted by the data selection window. 

6. (Original) The method of claim 4, further comprising storing the first 
downloaded captured data file and the histogram together in a folder. 

7. (Original) The method of claim 2, wherein presenting a user with a graphical 
user interface representation of the network traffic comprises applying a compression algorithm 
to at least a portion of the information in the histogram. 

8. (Original) The method of claim 3, wherein representing the segment of the 
capture histogram in a zoom histogram comprises applying a compression algorithm to at least a 
portion of the information in the histogram. 

9. (Canceled) 

10. (Original) The method of claim 4, further comprising coding portions of the 
capture histogram and the zoom histogram with a second indicator representing sections that 
were previously at the user computer, but that are not presently at the user computer. 

11. (Original) The method of claim 4, fiirther comprising coding portions of the 
capture histogram and the zoom histogram with a third indicator representing sections that are 
not stored at the user computer or at the network monitoring computer. 
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12. (Original) The method of claim 4, the histogram further comprising a listing 
and description of downloaded captured data files stored on the user computer, the method 
further comprising: 

using the listing and description of downloaded captured data files to color code 
portions of the capture histogram and the zoom histogram with a first color representing 
sections stored at the user computer; 

color coding portions of the capture histogram and the zoom histogram with a 
second color representing sections that were previously at the user computer, but that are 
not presently at the user computer; and 

color coding portions of the capture histogram and the zoom histogram with a 
third color representing sections that are not stored at the user computer or at the network 
monitoring computer. 

13. (Original) The method of claim 4, further comprising: 

downloading sections from the network monitoring computer that are not stored 
in downloaded captured data files at the user computer; and 

combining the downloaded sections with a downloaded captured data file that was 
previously stored at the user computer. 

14. (Original) The method of claim 1, further comprising saving the histogram 
for later use. 

15. (Original) Th e m e thod of claim 1 4 , fiirth e r comprising: A method of 
analyzing network traffic on a network, the network traffic having been captured at a network 
monitoring computer during a period of time, the method comprising: 

at a user computer remote fi-om the network monitoring computer, receiving data 
points corresponding to the captured network traffic, the data points comprising: 

for the captured network traffic, start time, end time, total fi-ames and total 
bytes: and 
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information about sections of the captured network traffic, the information 
including start time, end time, number of fi'ames in the section and number of 
bytes in the section: and 

storing a histogram, including the data points, at the user computer: 
saving the histogram for later use: 
opening the histogram: 

determining if the histogram corresponds to network traffic stored on the network 
monitoring computer using timestamps; and 

if the histogram corresponds to network traffic stored on the network monitoring 
computer, establishing a relationship between the network monitoring computer and the 
user computer such that network traffic existing on the network monitoring computer 
may be downloaded to the user computer. 

16. (Original) The method of claim 4, comprising saving a downloaded captured 
data file stored on the user computer for later use. 

17. (Original) The method of claim 16, comprising: 

creating an individual histogram for the downloaded captured data file stored on 
the user computer for later use; and 

displaying the individual histogram at the user computer. 

18. (Original) A computer readable medium with instructions for performing the 
method of claim 1. 

19. (Canceled) 

20. (Canceled) 

21 (Canceled) 

22 (Canceled) 
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23. (Canceled) 

24. (Canceled) 

25. (Canceled) 

26. (Canceled) 
27 (Canceled) 

28. (Canceled) 

29. (Canceled) 

30. (Canceled) 
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